import type { AppleSocialUser, SocialProvider } from './SocialProvider.js';
/**
 * Options for Apple identity-token verification.
 */
export interface AppleProviderOptions {
    /**
     * Expected Apple services ID or bundle ID for the token `aud` claim.
     */
    readonly clientId: string;
    /**
     * Apple JWKS endpoint override, primarily for tests.
     */
    readonly jwksEndpoint?: string;
    /**
     * Milliseconds to cache the fetched JWKS payload.
     */
    readonly jwksCacheTtlMs?: number;
    /**
     * Fetch implementation override, primarily for tests.
     */
    readonly fetch?: typeof globalThis.fetch;
    /**
     * Clock override used for deterministic cache tests.
     */
    readonly now?: () => number;
}
/**
 * Apple first-sign-in user name parts.
 */
export interface AppleUserName {
    /**
     * User's given name from Apple's first sign-in profile payload.
     */
    readonly firstName?: string;
    /**
     * User's family name from Apple's first sign-in profile payload.
     */
    readonly lastName?: string;
}
/**
 * Optional Apple first-sign-in profile payload supplied by the client application.
 */
export interface AppleUserProfile {
    /**
     * Name supplied by Apple only on the user's first sign-in.
     */
    readonly name?: string | AppleUserName | null;
}
/**
 * Verifies Sign in with Apple identity tokens against Apple's JWKS endpoint.
 */
export declare class AppleProvider implements SocialProvider<AppleSocialUser> {
    private readonly clientId;
    private readonly jwksEndpoint;
    private readonly jwksCacheTtlMs;
    private readonly fetch;
    private readonly now;
    private jwksCache;
    /**
     * @param options - Apple provider verification options.
     */
    constructor(options: AppleProviderOptions);
    /**
     * @param identityToken - Apple-issued identity token.
     * @param profile - Optional first-sign-in profile payload supplied by the client.
     * @returns Normalized Apple social user profile.
     * @throws UnauthorizedHttpException When the token is missing, rejected, or malformed.
     */
    verify(identityToken: string, profile?: AppleUserProfile): Promise<AppleSocialUser>;
    private findJwk;
    private getJwks;
    private toSocialUser;
}
//# sourceMappingURL=AppleProvider.d.ts.map